Installs into .claude/skills of the current project.
Are you the author of Production Auth?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/receptron-production-auth)
---
name: blueprint-internal-production-auth
description: "Put the sign-in restriction live on production before the site is: deploy functions and rules only, then register the blocking functions."
---
# Production sign-in restriction first
This step carries the **deploy-production** gate; the user approved it. It deploys only the back end, so that
when the site is published in the next step the domain restriction is already enforced.
1. `firebase deploy --project prod --only functions,firestore`. Do NOT deploy hosting here.
2. Make sure the production project is on Identity Platform — `sh <usecase pack>/checks/identity-platform.sh prod`
(with `BLUEPRINT_BASE` / `BLUEPRINT_USECASE` set) reads it; ask for the upgrade only if that fails. Then register `beforeUserCreated` and
`beforeUserSignedIn` under Authentication > Settings > Blocking functions. Give the user the URL and wait.
3. There is nothing for the user to try yet — the site is not published. The check reads the registration from
the project itself.
Done when the check passes: the production project's Identity Toolkit config lists both blocking triggers.
## Always
- Read `.blueprint/spec.md` first. It is the agreed specification; do not widen it.
- When you need a decision, ask it through the blueprint question tool and stop. Do not guess.
- Never enable billing, deploy to production, delete data or handle a credential unless this step's gates say the
user approved exactly that.
- Say you are done by stopping; the executor runs the check. Do not claim success yourself.
